Skip to content

fix(rotator): read codex CLI's nested auth.json shape#368

Merged
samxu01 merged 2 commits into
mainfrom
sprint/rotator-nested-auth-shape
May 15, 2026
Merged

fix(rotator): read codex CLI's nested auth.json shape#368
samxu01 merged 2 commits into
mainfrom
sprint/rotator-nested-auth-shape

Conversation

@samxu01
Copy link
Copy Markdown
Contributor

@samxu01 samxu01 commented May 15, 2026

codex CLI 0.125 writes nested {tokens: {...}}; rotator only looked at top-level. Read either shape.

samxu01 and others added 2 commits May 14, 2026 19:22
…ners

PR #366 was supposed to move codex-cli from initContainers to containers,
but the awk move only added the new entry and didn't delete the old one.
Result: spec had codex-cli in both lists, k8s rejected with
"spec.template.spec.initContainers[1].name: Duplicate value".

Strip the leftover container + its comment block. Final structure:
containers = [litellm, codex-auth-rotator, codex-cli],
initContainers = [codex-auth-seed].

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
codex CLI 0.125 writes auth.json as {tokens: {access_token, refresh_token,
id_token}, auth_mode, OPENAI_API_KEY, last_refresh}. The rotator's
_read_pod_auth_file only looked at top-level access_token, missed the
nested shape, returned None, and fell back to env-var candidates (which
are the laptop-bound dead tokens we're trying to escape).

Read either shape — nested wins, flat is the legacy rotator-written
fallback.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@samxu01 samxu01 merged commit 76c09e6 into main May 15, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant